Germany Strengthens Cybersecurity, Protecting Patient Data Remains a Priority

Berlin – Germany is advancing with new legislation designed to enhance national cybersecurity, responding to an increasingly sophisticated threat landscape. The proposed “Gesetz zur Stärkung der Cybersicherheit” (Law to Strengthen Cybersecurity) is currently under review, with the Kassenärztliche Bundesvereinigung (KBV), the Federal Association of Statutory Health Insurance Physicians, emphasizing the critical need to protect sensitive patient data alongside broader security improvements.

KBV Raises Concerns Over Potential Impact on Patient Confidentiality

The KBV has voiced concerns that the draft bill, submitted by the Federal Ministry of the Interior, lacks sufficient provisions to safeguard the confidentiality of communication between doctors and psychotherapists, who are legally bound by professional secrecy. The KBV argues that covert defensive measures outlined in the draft could potentially affect health data processed by contracted healthcare providers.

Specifically, the KBV is advocating for an extension of the protection afforded to communications subject to professional secrecy, as defined in Section 62 of the Federal Criminal Police Office Act (BKAG), to encompass the new proposed measures. A comparable regulation within the Federal Police Act is likewise being requested.

Covert Defensive Measures and Data Collection

The draft bill aims to bolster cybersecurity by enabling further covert defensive measures, including the redirection of data traffic and data collection. To facilitate this, amendments are proposed for both the Federal Police Act and the BKAG.

Protecting Health Data Under GDPR and Medical Confidentiality

The KBV underscores that health data receives particularly strong protection under the European General Data Protection Regulation (GDPR) and, within the doctor-patient relationship, through the principles of medical confidentiality. Doctors and psychotherapists retain the right to refuse to provide information.

Historical Context: BKAG and Protection of Professional Secrecy

The Federal Constitutional Court, in a 2016 decision regarding the BKAG, highlighted the special protection required for communications involving those subject to professional secrecy. This led to the introduction of Paragraph 62, which ensures the protection of individuals entitled to refuse to give evidence. However, the KBV contends that the current draft bill does not extend this protection to the proposed new regulations, as these would be included in a new Section 5a, which is not currently covered by Section 62 BKAG. The draft bill currently lacks a comparable provision for the Federal Police Act.

Ongoing Cybersecurity Efforts in Germany

This initiative builds upon existing regulations, such as the Digital Healthcare Act (Digitale-Versorgung-Gesetz), which already tasked the KBV with developing IT security guidelines for medical practices. The KBV has been actively involved in establishing and implementing IT security standards for healthcare providers in Germany, aiming to minimize risks such as data loss or operational disruptions. Germany’s commitment to cybersecurity is evident in its ongoing efforts to balance protection with patient data rights.